Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had a working OpenLDAP but broke it while trying to configure SSL using the instructions here: Now I'm getting the following error when I try to start ldap with -d -1:

TLS: only one of certfile and keyfile specified

main: TLS init def ctx failed: -1

Being a newbie, I think it's entirely possible that I messed something up (I have a concern that I did the ldapmodify step from the instructions above wrong), but I don't know how to undo what I've done. I can't start ldapmodify b/c the server is down. So I have two questions:

  1. What could be causing this error?
  2. How can I get back to my previously working (but no SSL) version of OpenLDAP?

Note: I am not a *nix admin and was only trying to get an SSL version of OpenLDAP to test my app against. So please talk slowly and use big words!

share|improve this question
up vote 2 down vote accepted

I don't have access to my openldap server right now, but I'm pretty sure you can change this directly in the fancy new slapd.d/ directory, even though it is not recommended.

See what you get when you run (assuming this is the directory containing your slapd configuration) this:

grep -R olcTLS /etc/openldap/slapd.d
share|improve this answer
That did it! I was able to see that I was missing one of the required config options. I added the olcTLSCertificateKeyFile and was able to get past that error. – jubil Oct 17 '11 at 13:52
On newest versions of Ubuntu, like Precise, the correct command is grep -R olcTLS /etc/ldap/slapd.d/ – Délawen Feb 21 '14 at 14:59

According to the above instructions:

If you run into troubles with the server not starting, check the /var/log/syslog. If you see errors like main: TLS init def ctx failed: -1, it is likely there is a configuration problem. Check that the certificate is signed by the authority from in the files configured, and that the ssl-cert group has read permissions on the private key.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.